Attackers are exploiting a critical, unauthenticated vulnerability in the open-source Langflow platform to steal AWS credentials, OpenAI API keys and other sensitive secrets, researchers have warned.
VulnCheck detected at least 50 attempts against its UK honeypots over one weekend, with most of the malicious traffic originating in Russia. The security firm later recorded 360 attacks in total as the activity intensified.
The flaw, tracked as CVE-2026-0768, affects Langflow’s custom component editor and allows an attacker to execute code remotely with root privileges, without logging in.
Langflow attacks target cloud and AI credentials
VulnCheck lead security researcher Caitlin Condon said the attackers were conducting reconnaissance before querying environment variables and files on compromised systems.
The information sought included Langflow administrative credentials, superuser keys, AWS access and secret keys, and OpenAI API credentials. Attackers also checked for SSH access and examined the size of users’ shell history files, Condon said.
Langflow is a Python-based, low-code tool that allows developers to build AI applications, agents, chatbots and retrieval-augmented generation systems by connecting models, prompts, databases and other services through a graphical interface.
The vulnerability was disclosed in January and affects versions 1.4.2 and earlier. It is located in the handling of the code parameter sent to Langflow’s validation endpoint, where a user-supplied string can be executed as Python code without adequate checks.
Condon said there was no known publicly available proof-of-concept exploit for the vulnerability, despite the attacks already being observed in the wild.
Users have been advised to upgrade to Langflow 1.11.6, which addresses the known security weaknesses affecting the platform.
CVE-2026-0768 is the latest in a series of Langflow flaws targeted by attackers this year. Earlier incidents involved vulnerabilities that were used to run Python scripts, retrieve environment and database files, write arbitrary files, access other users’ AI workflows and deploy further malware.
Attackers have also exploited Langflow vulnerabilities to extract cloud credentials, environment variables and container metadata. The US Cybersecurity and Infrastructure Security Agency has separately warned that another flaw, CVE-2026-9198, was being exploited after public proof-of-concept code emerged.
